Just to add to what WM said, you really have to be careful about emails of this kind. I really hate the apps on phones which hide the actual email address that sent the mail or that you reply to.
In this case you replied, which means they sent from a mail address which was close but not the same with a "name" which was correct. Most email systems only show the "name". If you click on the name it shows the mail address at which point you can see it is bogus. For instance getting a mail from apple.mail.com is not the same as getting a mail from mail.apple.com. apple.com is the domain, the bit before, mail, is just the department. Most people don't understand the difference and are confused. In this instance the email would purport to come from apple but really was sent from "mail.com".
Then, when you replied, you compounded the situation because your mail client remembered the bogus email address with the correct name.
In this case you close the mail, create a new mail to the company, using your known address, which should be remembered. At which point they will tell you that you have been scammed.
Glad it didn't get through, but simple basic precautions protect you every time. If it is a mail about money, click on the name, look at the address, verify it. Then close it and create a new mail to your known address asking for confirmation.